Falhas do tipo CWE-470

64 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2026-46562CRITICALYamcs: Remote Code Execution via Mission Database algorithm overrideEPSS 0.8%CVE-2026-42027CRITICALApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderEPSS 0.7%CVE-2023-32217CRITICALSailPoint IdentityIQ Unsafe use of Reflection VulnerabilityEPSS 0.6%CVE-2024-8014HIGHTelerik Reporting EntityDataSource Insecure Type ResolutionEPSS 0.6%CVE-2025-34393CRITICALBarracuda RMM < 2025.1.1 Service Center Insecure Reflection RCEEPSS 0.6%CVE-2026-8178CRITICALRemote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC DriverEPSS 0.6%CVE-2026-44795HIGHSpinnaker: Non-safe yaml deserialization allowing RCE when using specific typesEPSS 0.5%CVE-2024-7059HIGHA high-severity vulnerability that can lead to arbitrary code execution on the system hosting the Web SDK role was found in the Genetec SecuEPSS 0.5%CVE-2026-34216MEDIUMCtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.phpEPSS 0.5%CVE-2024-22258MEDIUMCVE-2024-22258: PKCE Downgrade in Spring Authorization ServerEPSS 0.5%CVE-2026-32264HIGHCraft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsControllerEPSS 0.5%CVE-2024-53850HIGHThe Addressing GLPI plugin allows data enumeration through uncontrolled object instantiationEPSS 0.5%CVE-2026-32263HIGHCraft CMS vulnerable to behavior injection RCE via EntryTypesControllerEPSS 0.5%CVE-2025-31119HIGHCWE-470 in generator-jhipster-entity-audit when having Javers selected as Entity Audit FrameworkEPSS 0.5%CVE-2026-49287HIGHStatamic CMS vulnerable to unsafe method invocation via collection sorting allows data destructionEPSS 0.5%CVE-2026-13181HIGHRadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAXEPSS 0.5%CVE-2025-12967HIGHAn issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rds_superuser role. A low privilege authenticateEPSS 0.4%CVE-2025-2794HIGHKentico Xperience <= 13.0.180 Unsafe ReflectionEPSS 0.4%CVE-2026-46718MEDIUMApache Calcite: A user-controled model can load arbitrary classes, leading to code executionEPSS 0.4%CVE-2026-40008CRITICALApache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPCEPSS 0.4%